Privacy Policy — mon4d Platform

The following terms carry the meanings set out below throughout this Privacy Policy:

We collect the following categories of Personal Data from Players, depending on how they interact with the Platform:

2.1 Registration Data
When you create an account, we collect your full legal name, date of birth, email address, phone number, and residential address. This information is required to open an account and cannot be omitted.

2.2 Identity Verification (KYC) Data
To comply with our anti-money-laundering obligations and to verify that you are at least 21 years of age, we may request copies of a government-issued photo ID (Indonesian KTP, SIM, or passport), a utility bill or bank statement as proof of address, and — where applicable — a photograph or selfie for biometric verification against your submitted ID document.

2.3 Financial Data
We record details of all deposits and withdrawals, including the payment method used (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja), transaction amounts in Indonesian Rupiah (IDR / Rp), and timestamps. We do not store full bank account passwords or full card numbers on our servers; this sensitive credential data is handled exclusively by our licensed payment processors.

2.4 Gameplay & Betting Data
We retain a complete record of your betting activity, including all wagers placed across sportsbook markets (BRI Liga 1, EPL, La Liga, Champions League, AFF Cup, Timnas Indonesia fixtures), live casino sessions, slot spins, togel draw entries, and e-sports markets. This data is essential for account integrity, dispute resolution, and responsible gaming monitoring.

2.5 Device & Technical Data
When you access the Platform, our servers automatically record your IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, referring URL, and session timestamps. This data is used for security monitoring, fraud prevention, and service optimization.

2.6 Communications Data
We retain records of all communications between you and our support team, including live chat transcripts, emails sent to [email protected], and any formal complaints or feedback submitted through the Platform.

2.7 Promotional Preferences
If you opt in to marketing communications, we store your preferences regarding bonus notifications, match-day promotions, and seasonal campaign alerts (such as those tied to Idul Fitri, Imlek, or major tournament events like the FIFA World Cup or AFF Cup).

Personal Data is collected through the following means:

• Direct submission: Information you actively provide during account registration, KYC verification, deposit or withdrawal requests, support interactions, and promotional opt-ins.
• Automated technical collection: Device and session data captured automatically by our servers each time you visit or interact with the Platform, including through cookies and similar tracking technologies (see Section 9).
• Third-party verification services: Identity data returned by licensed KYC and document verification providers when we initiate a verification check on your submitted documents.
• Payment processors: Transaction confirmation data returned by payment gateways processing your deposits and withdrawals through local Indonesian banking channels and e-wallets.
• Fraud prevention agencies: Risk signals and device fingerprint data shared with our fraud detection partners to assess the legitimacy of account activity in real time.

We process your Personal Data for the following specific, legitimate purposes:

We will not use your Personal Data for any purpose that is incompatible with the purposes listed above without first providing you with prior notice and, where required, obtaining your consent.

The Company processes your Personal Data on one or more of the following legal bases, depending on the nature of the processing activity:

• Contractual necessity: Processing that is required to fulfill the contract between you and mon4d — namely, operating your account, processing transactions, and delivering Platform services — is carried out on the basis that it is necessary to perform that contract.
• Legal obligation: Processing carried out to comply with applicable laws and regulations, including KYC identity verification, anti-money-laundering record-keeping, and age restriction enforcement, is conducted on the basis of legal obligation.
• Legitimate interests: Processing for fraud detection, security monitoring, service improvement, and responsible gaming oversight is conducted on the basis of our legitimate interest in operating a secure, fair, and sustainable platform — provided that this interest is not overridden by your fundamental rights and freedoms.
• Consent: Processing for direct marketing and promotional communications is conducted solely on the basis of your freely given, specific, and informed consent. You may withdraw this consent at any time by contacting [email protected] or updating your account preferences, without affecting the lawfulness of processing carried out before withdrawal.

mon4d does not sell your Personal Data to third parties for their own marketing purposes. We may share your Personal Data with third parties only in the following strictly limited circumstances:

• Payment processors: We share the minimum necessary financial and identity data with licensed payment gateway providers — including those facilitating transfers through BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja — solely to execute and record your transactions.
• Identity verification providers: We share KYC document data with licensed third-party identity verification services to confirm your identity and age as required by our operating obligations.
• Fraud prevention and security partners: We share device and behavioral signals with fraud detection partners to identify and prevent unauthorized account access, bonus abuse, and financial crime.
• Game content providers: For games delivered by third-party studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — limited session data may be shared with those providers solely to operate and verify game outcomes. These providers operate under strict data processing agreements.
• Regulatory and law enforcement authorities: We will disclose Personal Data to competent authorities where we are required to do so by applicable law, valid court order, or regulatory directive. We will notify you of such disclosures where legally permitted to do so.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of the Company's assets, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections.

We retain your Personal Data for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized in a manner that prevents reconstruction of any identifiable information.

mon4d implements industry-standard technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your browser or device and our servers, including during login, account registration, deposit and withdrawal flows, and support interactions.
• At-rest encryption for all Personal Data stored in our databases, using AES-256 encryption or equivalent standards.
• Access controls: Personal Data is accessible only to authorized Company personnel and Third-Party Processors who have a documented, role-specific need to access it. Access is governed by the principle of least privilege and is subject to periodic review.
• Multi-factor authentication for all internal system access by Company staff.
• Continuous security monitoring including intrusion detection systems, automated anomaly alerts, and regular third-party penetration testing of the Platform.
• Data backup and recovery: Personal Data is backed up on a regular schedule to geographically redundant secure servers to prevent data loss in the event of a system failure.

While we apply rigorous security standards, no electronic transmission or storage system can be guaranteed to be 100% secure. In the unlikely event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and will take all necessary steps to contain and remediate the breach.

The Platform uses cookies and similar tracking technologies to deliver a functional, personalized, and secure experience. The following cookie categories are used:

You may control non-essential cookies through your browser settings. Please note that disabling functional or analytics cookies may affect the quality of your experience on the Platform. Disabling strictly necessary cookies will prevent the Platform from functioning correctly and you will not be able to log in or place bets.

We do not use third-party advertising cookies or cross-site tracking cookies for retargeting purposes on external advertising networks.

Depending on the jurisdiction in which you reside and the legal basis applicable to each processing activity, you may have the following rights in respect of your Personal Data:

• Right of access: You have the right to request a copy of all Personal Data we hold about you, including the purposes for which it is processed and the categories of third parties with whom it has been shared.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete Personal Data we hold about you. You can update basic profile information directly through your account settings; for KYC-verified data, please contact our support team.
• Right to erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and there is no other legal basis for continued processing. Please note that this right is subject to our legal obligations to retain certain data (see Section 7).
• Right to restriction: You may request that we restrict the processing of your Personal Data in certain circumstances — for example, while a dispute regarding accuracy is being resolved.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you may request a copy of your Personal Data in a structured, machine-readable format.
• Right to object: Where processing is based on legitimate interests, you may object to that processing. We will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of the above rights, please contact us at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 48 hours and respond substantively within 30 calendar days. We may require identity verification before fulfilling a data rights request to ensure that Personal Data is not disclosed to unauthorized parties.

The mon4d Platform is strictly intended for adults aged 21 years and over. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step in the account registration and KYC process, and we reserve the right to request proof of age at any point in the account lifecycle.

If we become aware that Personal Data has been collected from a person under the age of 21 — whether through a false declaration of age or any other means — we will immediately suspend the relevant account, void any associated winnings, and permanently delete the Personal Data in question as quickly as our legal obligations permit.

If you are a parent or guardian and believe that your child has registered an account on the Platform, please contact us immediately at [email protected]. We will investigate and take appropriate action without delay.

mon4d reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When material changes are made, we will notify registered Players by email to the address associated with their account, and we will update the "Last Updated" date at the top of this page.

Non-material changes — such as minor clarifications of existing language, corrections of typographical errors, or additions that do not affect your rights — may be made without individual notification. We encourage you to review this Privacy Policy periodically to stay informed of how we are protecting your data.

Your continued use of the Platform following the posting of an updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with any material change, you should discontinue use of the Platform and contact us to request account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which mon4d processes your Personal Data, please reach out through any of the following channels:

• Email: [email protected] — plain text address; not a clickable link. Type this address directly into your email client.
• Live Chat: Available directly within the Platform after login. Our Indonesian-speaking support agents are on duty 24 hours a day, 7 days a week.
• Response Time: All Privacy-related inquiries will be acknowledged within 48 hours and fully resolved within 30 calendar days.
• Support Hours: 24/7 coverage across WIB (UTC+7), WITA (UTC+8), and WIT (UTC+9) time zones.

For general account questions, responsible gaming support, or Terms & Conditions queries, please also refer to our FAQ, Responsible Gaming, and Terms & Conditions pages.